Courseiva
← PCNE
Full test
Configuring Network Services →easyMultiple ChoiceObjective-mapped

PCNE Configuring Network Services Practice Question

Exhibit

Refer to the exhibit.

$ gcloud compute networks subnets list

NAME          REGION       NETWORK  RANGE          PRIVATE_GOOGLE_ACCESS  STACK_TYPE
subnet-a      us-central1  vpc1     10.0.1.0/24    Enabled                IPV4_ONLY
subnet-b      us-east1     vpc1     10.0.2.0/24    Disabled               IPV4_ONLY

A VM in 'subnet-a' can access Google APIs via private IP, but a VM in 'subnet-b' cannot.

Refer to the exhibit. A VM in 'subnet-a' can access Google APIs via private IP, but a VM in 'subnet-b' cannot. What change should be made to fix this?

⚠ Common exam trap

Google Cloud often tests the distinction between enabling outbound internet access (Cloud NAT) and enabling private access to Google services (Private Google Access), leading candidates to mistakenly choose Cloud NAT when the requirement is specifically for private IP access to Google APIs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable Private Google Access on subnet-b.

Private Google Access enables a VM that has only an internal IP address (no external IP) to reach Google APIs and services through the default internet gateway using Google's private network. Since subnet-b lacks this setting, VMs there cannot reach Google APIs via private IP. Enabling Private Google Access on subnet-b resolves this by allowing the VM's traffic to be routed to Google APIs without needing an external IP.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Change the stack type of subnet-b to IPV4_IPV6.

    Why it's wrong here

    Stack type does not affect private access.

  • ✗

    Configure Cloud NAT in the region of subnet-b.

    Why it's wrong here

    Cloud NAT provides outbound internet access for private VMs, but the scenario requires private IP access to Google APIs, which is achieved via Private Google Access, not NAT. Cloud NAT would enable internet-bound traffic but does not route traffic to Google APIs over the internal Google network. It is tempting because NAT is commonly used for outbound connectivity, and in scenarios where VMs need to reach external endpoints via public IPs, Cloud NAT would be the correct solution.

  • ✗

    Add a firewall rule allowing egress to 0.0.0.0/0 on port 443 for subnet-b.

    Why it's wrong here

    Firewall rules do not enable Private Google Access.

  • ✓

    Enable Private Google Access on subnet-b.

    Why this is correct

    Enabling Private Google Access allows VMs to reach Google APIs via internal IP.

Visual reference

Client Recursive Resolver Root DNS (13 root servers) TLD DNS (.com, .org, …) Authoritative example.com query IP addr answer

About these practice questions

One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.